Previous works [1]}, [2]}, [3]}, [4]} showed that if an instance is part of the training dataset of the target model, its loss is most likely less than the case when it is not part of the training dataset.
That is, in this attack, we provide our instantiated adversary with an extremely
limited power. In particular, the attacker has much less capabilities than what is assumed to analyze the differential privacy guarantees provided by DP-SGD. fig:protocol1 summarizes the attack.
